Which versions of AgentFlow are affected by CVE-2026-7466?

berabuddies AgentFlow users are at risk from a code execution vulnerability affecting all versions prior to fix commit 1667fa3, where attackers can execute arbitrary Python scripts through the…. A patch is available.

How to fix or mitigate CVE-2026-7466?

Within 24 hours, inventory all systems running berabuddies AgentFlow and identify which teams depend on it for critical workflows; establish a testing environment for validation. Within 7 days, obtain the patched version (commit 1667fa3 or later), test it thoroughly in your controlled environment, and begin staged deployment starting with non-production systems. Complete full deployment of the patched AgentFlow version across all systems by day 30, verify the patch is active and version-correct, and consider implementing network segmentation to limit access to the local API endpoint on port 127.0.0.1.

AgentFlow CVE-2026-7466

Q: What is the CVSS score of CVE-2026-7466?

CVE-2026-7466 has a CVSS 4.0 base score of 7.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26279 HIGH

Code Injection (CWE-94)

2026-04-29 VulnCheck

RCE Python Code Injection Agentflow

7.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Localhost API reachable via CSRF-style browser requests gives AV:N/UI:R; needing an existing malicious .py on disk plus an induced request makes AC:H; the local API requires no auth so PR:N; code execution yields full C/I/A.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 01:30 vuln.today

Analysis Generated

Jul 24, 2026 - 01:30 vuln.today

Patch released

Apr 30, 2026 - 15:44 nvd

Patch available

Apr 29, 2026 - 20:01 EUVD

CVSS changed

Apr 29, 2026 - 19:22 NVD

8.8 (HIGH) 7.7 (HIGH)

EUVD ID Assigned

Apr 29, 2026 - 19:00 euvd

EUVD-2026-26279

CVE Published

Apr 29, 2026 - 18:44 nvd

HIGH 7.7

DescriptionCVE.org

AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipeline_path parameter to the POST /api/runs and POST /api/runs/validate endpoints. Attackers can induce requests to the local AgentFlow API to load and execute existing Python pipeline files on disk, resulting in code execution in the context of the user running AgentFlow.

AnalysisAI

Arbitrary code execution in berabuddies AgentFlow (all versions prior to fix commit 1667fa3) allows attackers to run local Python pipeline files by supplying a user-controlled pipeline_path parameter to the POST /api/runs and POST /api/runs/validate endpoints of the local web API. Because 'agentflow serve' binds its control plane to 127.0.0.1, an attacker who can induce requests to that local API - for example via a victim's browser - can make it load and execute an existing .py pipeline on disk, gaining code execution as the user running AgentFlow. No public exploit is identified at time of analysis and EPSS is very low (0.04%), but SSVC rates the technical impact as total.

Technical ContextAI

AgentFlow is a Python-based agent/pipeline orchestration tool that exposes a local web UI and REST API (agentflow serve) for running and validating pipeline definitions. The flaw is a CWE-94 improper control of code generation (code injection) issue: the /api/runs and /api/runs/validate endpoints accepted a pipeline_path payload field pointing to a filesystem path, and AgentFlow then loaded and executed that Python pipeline file. Executing a .py pipeline is by design equivalent to running arbitrary Python, so any request that controls pipeline_path controls what code runs. The single affected CPE, cpe:2.3:a:berabuddies:agentflow:*:*:*:*:*:*:*:*, confirms a single-vendor, single-product scope. The fix (PR #18) disables pipeline_path on the browser-facing API by default, enforces an application/json content type, and gates path loading behind the explicit AGENTFLOW_API_ALLOW_PIPELINE_PATH environment variable.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the changes from https://github.com/berabuddies/agentflow/pull/18 (fixed at commit 1667fa3), which disable pipeline_path on the /api/runs and /api/runs/validate endpoints by default, require an application/json content type (returning 415 otherwise), and only permit filesystem path loading when the operator explicitly sets AGENTFLOW_API_ALLOW_PIPELINE_PATH=1. Until you can update, keep AGENTFLOW_API_ALLOW_PIPELINE_PATH unset/disabled, ensure agentflow serve continues to bind only to 127.0.0.1 (do not expose it on 0.0.0.0 or behind a reverse proxy), and restrict which local users and browser origins can reach the API since a browser-driven request can trigger it; the trade-off of leaving the opt-in disabled is that legitimate filesystem-path pipeline loading via the web API stops working and must be done through the CLI or inline JSON pipeline specs instead. Confirm details against the VulnCheck advisory and the VulDB entry (https://vuldb.com/vuln/360199).